CVE-2026-28410 Details

A vulnerability in The Graph's token vesting contracts, present in versions through 2.0.0, allows users to access tokens that should remain locked according to their vesting schedule. The issue arises because the contracts incorrectly tracked token usage in relation to vested amounts, creating a loophole. Users could withdraw vested tokens, use them in the protocol, and then withdraw the same amount again, effectively 'double-spending' their tokens. This flaw disrupted the vesting contract's accounting, complicating token revocation processes.

The vulnerability has been patched in The Graph version 3.0.0, which removed the flawed tracking of used tokens and restricted interactions with the protocol to non-revocable vesting contracts.